Aspera Shares EUVD-2025-209178

The CVSS 3.1 score of 6.3 reflects medium risk with network accessibility and low complexity (AV:N/AC:L), but the critical prerequisite is authentication (PR:L), which limits the attack surface. EPSS data is not provided, but the risk profile is meaningful: the vulnerability enables post-compromise lateral movement and account impersonation within an authenticated context. The primary risk is that an administrator or privileged user performing a password reset on a compromised account may not fully revoke the attacker's access if the attacker maintains an active session. Real-world impact depends on the confidentiality and integrity of data accessible through Aspera Shares and the frequency of password resets in the operational environment. This is not a critical unauthenticated remote code execution, but represents a genuine privilege persistence risk in multi-user deployments where account compromise is possible.

A network administrator's Aspera Shares account is compromised via phishing. Before the administrator detects the breach and resets their password, an attacker maintains an active session token. After the password reset is performed, the attacker's session remains valid and functional, allowing continued file access and potential lateral movement within the Aspera Shares environment under the administrator's identity. No public exploit code is known to exist; exploitation requires pre-existing authentication or session token access.